Code generators play a critical role in the Model Based Development of complex software systems. This is particularly true in the automotive domain, where the code auto-generated from Simulink/Stateflow models is directly flashed onto embedded controllers. Testing based approaches are popular for validating the translation of models to code. However, these approaches cannot guarantee the absence of bugs introduced during translation.

Correct functioning of automotive embedded controllers requires hard real-time constraints on a number of system parameters. To avoid costly design iterations, these timing constraints should be verified during the design stage itself. In this paper, we describe a formal verification technique for a class of timing constraints called timing synchronization constraints in the recent adaptation of AUTOSAR standard (WPII-1.2 Timing Subgroup, Release 4.0). These constraints require, unlike the well studied end-to-end latency constraint, simultaneous analysis of multiple task/message chains or multiple data items traversing through a task/message chain. We show that they can be analyzed by model-checking with finite-state monitors. We also demonstrate this method on a case-study from the automotive domain.

Embedded control systems in automobiles are typically implemented by a set of tasks deployed on multiple Electronic Control Units (ECUs) communicating via one or more buses like CAN or FlexRay. In the case of safety-critical systems, there are hard real-time bounds on the (i) response times of tasks/messages, and (ii) end-to-end latencies of certain task/message chains. These depend on various factors like the number of tasks (and messages) involved in the processing (and communication) sequence, parameters of these tasks/messages, scheduling policies, communication protocols, clock drifts, etc. Moreover, since the data transfer among tasks/messages is typically via asynchronous buffers that are overwritable and sticky, multiple semantics are possible for end-to-end latency. Hence, precise estimation of response times and end-to-end latencies in embedded systems is a non-trivial problem.

We present the CoGenTe tool for automated black-box testing of code generators. A code generator is a program that takes a model in a high-level modeling language as input, and outputs a program that captures the behaviour of the model. Thus, a code generator's input and output are complex objects having not just syntactic structure but execution semantics, too. Hence, traditional test generation methods that take only syntax into account are not effective in testing code generators. CoGenTe amends this by incorporating various coverage criteria over semantics. This enables it to generate test-cases with a higher potential of revealing subtle semantic errors in code generators. CoGenTe has uncovered such issues in widely used real-life code generators: (i) lexical analyzer generators Flex and JFlex, and (ii) The MathWorks' simulator/code generator for Stateflow.

End-to-end latency of messages is an important design parameter that needs to be within specified bounds for the correct functioning of distributed real-time control systems. In this paper we give a formal definition of end-to-end latency, and use this as the basis for checking whether a stipulated deadline is violated within a bounded time. For unbounded verification, we model the system as a set of communicating Timed Automata, and perform reachability analysis. The proposed method takes into account the drift of clocks which is shown to affect the latency appreciably. The method has been tested on a medium sized automotive example.

This paper addresses the problem of testing auto-code generators. Auto-code generators take as input a model in certain modeling language, and produce as output a program that captures the execution semantics of the input-model. We focus on the problem of test specification for the purpose of automatically generating a test-suite. We propose a novel technique for test specification based on the execution behavior of models. We also propose an algorithm that uses such a behavioral test specification for directing test-case generation towards very specific behavioral patterns that we would like to exercise. We have implemented this technique, and have applied it for generating test-cases for a Stateflow auto-code generator.

Model-based development is increasingly becoming the method of choice for developing embedded systems for applications in automotive and aerospace industries. It relies on tool-suites consisting of a variety of model-processing tools like simulators, model-translators and code-generators. The correctness of these tools used in the development process is a key requirement for safety critical applications. This paper proposes a novel testing methodology for the rigorous verification of model processing tools. The proposed methodology takes as input the syntactic and semantic meta-model of a modeling language, expressed in the form of inference rules. Using a coverage criteria over this meta-model, it generates test-models, and test-inputs for these test-models. Apart from testing the syntactic aspects of the translation, our method aims at testing subtle semantic interactions of the modeling language that are potentially mistranslated by the model-processing tools. We illustrate the methodology with a simple prototypical process calculus. We also report on the experiments carried out with Stateflow, a variant of hierarchical state-machines implemented in the Matlab/Simulink tool-suite

We address the problem of rigorous testing of program generators. Program generators are software that take as input a model in a certain modeling language, and produce as output a program that captures the execution semantics of the input-model. In this sense, program generators are also programs and, at first sight, the traditional techniques for testing programs ought to be applicable to program generators as well. However, the rich semantic structure of the inputs and outputs of program generators poses unique challenges that have so far not been addressed sufficiently in the testing literature. We present a novel automatic test-case generation method for testing program generators. It is based on both syntax and semantics of the modeling language, and can uncover subtle semantic errors in the program generator. We demonstrate our method on flex, a prototypical lexical analyzer generator.